CVE-2024-34891 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords vi… |
CVE-2024-34885 | Medium | 6.8 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via… |
CVE-2024-34887 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators ac… |
CVE-2024-34883 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts password… |
CVE-2024-34882 | Medium | 4.9 | 2024-11-04 | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an… |
CVE-2023-1720 | Critical | 9.6 | 2023-11-01 | Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and… |
CVE-2023-1719 | High | 7.5 | 2023-11-01 | Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the se… |
CVE-2023-1718 | High | 7.5 | 2023-11-01 |
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-se… |
CVE-2023-1717 | Critical | 9.6 | 2023-11-01 |
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitr… |
CVE-2023-1716 | Critical | 9.0 | 2023-11-01 |
Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's brows… |
CVE-2023-1715 | Critical | 9.0 | 2023-11-01 |
A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags… |
CVE-2023-1714 | High | 8.8 | 2023-11-01 | Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitr… |
CVE-2023-1713 | High | 8.8 | 2023-11-01 | Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authentic… |
CVE-2022-43959 | Medium | 4.9 | 2023-01-20 | Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP… |
CVE-2017-20122 | Low | 3.5 | 2022-06-30 | A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2022-27228 | Critical | 9.8 | 2022-03-22 | In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. |
CVE-2020-28206 | Medium | 6.5 | 2020-12-02 | An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attem… |
CVE-2020-13484 | Critical | 9.8 | 2020-06-24 | Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL ho… |
CVE-2020-13483 | Medium | 6.1 | 2020-06-24 | The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. |
CVE-2008-2052 | Medium | 6.1 | 2008-05-02 | Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing at… |